xpm-aur

A Rust AUR helper for X Linux. It queries the AUR, resolves dependencies, builds source packages with makepkg, and performs every package transaction through xpm instead of pacman.

xpm-aur is a companion to xpm, not a replacement for pacman. makepkg still comes from the pacman package when source builds are needed (optional build tool, not a transaction backend), and builds still execute the PKGBUILD as bash. What changes is the transaction backend: xpm owns installs, removals and the package database, and AUR metadata lives in a small, explicit sidecar.

Status: MVP. The common daily workflows are implemented and tested. AUR signature/attestation policy and a public binary cache are future work.

Features

• Combined official + AUR search and package information (--aur/--repo to restrict).
• Recursive dependency resolution across official repositories and AUR.
• provides, version constraints, conflicts, replacements and split packages.
• Build order for AUR package bases; independent bases build in parallel while xpm installs and state updates stay sequential.
• Builds through xpm build in clean chroots prepared with xpm bootstrap and entered with arch-chroot. One shared base-devel template is reused per architecture; each build gets a cheap disposable copy (btrfs snapshot, reflink or overlayfs) and shares xpm's package cache and sync database.
• xpm installs the resulting packages.
• Installs, removes and upgrades through xpm.
• Tracks origin=aur, AUR version and git commit in a sidecar state file.
• --devel rebuilds VCS packages when HEAD changes.
• adopt imports AUR packages installed by yay or another helper.
• getpkgbuild clones/updates AUR PKGBUILDs for inspection.
• Foreign/installed queries (-Qm) and --nocheck.
• yay/pacman-style command forms: -S, -Syu, -Ss, -Si, -Rns, -Qm, -Sc.

Progress bars

xpm-aur has its own phase bars, separate from xpm's package progress:

• sync and resolve → cross fill [xxxxxxxxxx----------];
• checkout, building and installing → slash fill [//////////----------].

Downloads performed through xpm use xpm's own cross-fill download bars. There is no combined progress line.

Install

From source:

cargo build --release
sudo install -Dm755 target/release/xpm-aur /usr/local/bin/xpm-aur

From the X repository:

xpm install xpm-aur

Runtime requirements: xpm >= 0.1.0-30, git, base-devel, arch-install-scripts (for arch-chroot), and a normal user for building. xpm-aur invokes the configured sudo command for xpm transactions and for xpm build when it needs a chroot.

Run xpm-aur as a normal user. The X installer is the only supported root path: it builds inside a chroot. If chroot builds are disabled (--no-chroot), root execution is rejected instead of failing later in makepkg.

Usage

xpm-aur search yay
xpm-aur info yay

xpm-aur install yay
xpm-aur install --print yay          # resolve and print the plan only
xpm-aur install --aur --rebuild foo-git
xpm-aur install --remove-conflicts foo-git
xpm-aur install -j 4 a b c            # build up to four bases at once

xpm-aur upgrade                      # xpm upgrade + AUR updates
xpm-aur upgrade --aur --devel        # AUR only, VCS HEAD checks

xpm-aur remove foo
xpm-aur remove -s foo                # recursive
xpm-aur remove -n foo                # purge config files

xpm-aur query
xpm-aur query --quiet
xpm-aur adopt                        # import yay-installed AUR packages
xpm-aur clean --all

Compatibility forms are accepted as well:

xpm-aur -S foo
xpm-aur -Syu --noconfirm
xpm-aur -Ss yay
xpm-aur -Si yay
xpm-aur -Rns foo
xpm-aur -Qm
xpm-aur -Sc

How it works

1. xpm sync refreshes the sync databases.
2. The resolver reads installed packages from xpm's local database and official metadata from xpm's sync DB. Pacman's databases are read only with --compat-pacman-db or [database] compat_pacman = true.
3. Official packages are installed by xpm as one batch.
4. AUR package bases are cloned/updated and built with xpm build. Independent bases build concurrently (default: up to 2, or --jobs); dependency levels still build only after their prerequisites. Each finished base is installed with xpm install serially, so package transactions never overlap.
5. xpm-aur records the AUR base, commit, version and split outputs in $XDG_STATE_HOME/xpm-aur/state.json.

Build and package caches live in $XDG_CACHE_HOME/xpm-aur/:

build/       AUR git checkouts and makepkg work trees
packages/    built .pkg.tar.zst files
sources/     makepkg source cache

xpm-aur clean --all also removes the shared chroot base at /var/lib/archbuild/xpm-aur (configurable with paths.chroot); a plain clean leaves chroots alone.

The chroot template is refreshed automatically after 7 days, when it is missing or incomplete, or with xpm build --chroot-refresh. Build dependencies are installed inside the disposable root by xpm; the host only receives runtime dependencies in chroot mode.

Configuration

Optional ~/.config/xpm-aur/config.toml:

[aur]
rpc_url = "https://aur.archlinux.org/rpc/v5"
git_url = "https://aur.archlinux.org"

[commands]
xpm = "xpm"
sudo = "sudo"          # empty disables sudo

[build]
run_checks = true
chroot = true
extra_args = []
jobs = 2               # parallel AUR bases; 0 = auto

[database]
compat_pacman = false  # also read pacman's local/sync DBs (explicit)

[paths]
build = "~/.cache/xpm-aur/build"
packages = "~/.cache/xpm-aur/packages"
sources = "~/.cache/xpm-aur/sources"
cache = "~/.cache/xpm-aur"
chroot = "/var/lib/archbuild/xpm-aur"
state = "~/.local/state/xpm-aur/state.json"

Command-line flags override the file; XPM_AUR_CONFIG, XPM_AUR_STATE and XPM_AUR_CACHE are also honoured.

Safety

• AUR PKGBUILDs are untrusted executable bash. Review them before building. Builds run in a clean chroot by default (xpm bootstrap plus arch-chroot), but the chroot is not a security sandbox against hostile build scripts.
• xpm-aur never runs makepkg directly and never calls pacman to install. The only root build path is the X installer, which deliberately uses a clean chroot.
• xpm-aur does not sign or publish built packages. A local signed binary repository is planned.
• Do not run xpm-aur and yay/pacman concurrently when pacman compatibility is enabled. In the native flow xpm-aur reads/writes xpm's DB only; explicit compatibility mode can take pacman's db.lck while mirroring.

Differences from yay

• Transactions go through xpm; yay uses libalpm.
• xpm-aur requires makepkg but does not use pacman for install/remove.
• Pacman's databases are opt-in (--compat-pacman-db); yay relies on them by default. -Qm/adopt therefore see xpm-managed packages unless compatibility mode is enabled.
• The state sidecar is explicit and readable; yay relies on the pacman DB.
• The compatibility layer covers common forms, not every yay flag. Native xpm-aur subcommands are the source of truth.

Development

cargo fmt --all --check
cargo clippy --all-targets -- -D warnings
cargo test

The workspace is split into a pure core and adapters; see docs/ARCHITECTURE.md. Command compatibility is documented in docs/COMPATIBILITY.md.